CVE-2026-120630criticalCWE-918

CVE-2026-120630: critical vulnerability in CrewAI

CVE-2026-120630

Published · Updated

Follow this CVE+ Monitor CrewAI

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.1epss 0.2%
CrewAI contains an SSRF vulnerability caused by its SSRF guard and HTTP client, which both miss malicious content in URLs by checking opposite content passed to it, enabling any request that injects a malicious URL to perform SSRF, such as with the ScrapWebsiteTool.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
CrewAI · CrewAI
Related CVEs — CrewAI

In the same product, most dangerous first.

CVE-2026-2287CRITICALCVE-2026-2287EPSS 0.8%CVE-2026-2285HIGHCVE-2026-2285EPSS 0.6%CVE-2026-2286CRITICALCVE-2026-2286EPSS 0.5%CVE-2026-2275CRITICALCVE-2026-2275EPSS 0.5%CVE-2026-92206HIGHCrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-37008HIGHCVE-2026-37008EPSS 0.2%